# Sensu to send logs to logstash

**URL:** <https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920>\
**Category:** Logstash\
**Created:** [February 13, 2017, 6:56pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920 "2017-02-13T18:56:24Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 13, 2017, 6:56pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/1 "2017-02-13T18:56:24Z")

</div>

im not able to see logs from to elk

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2017, 6:50am UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/2 "2017-02-14T06:50:32Z")

</div>

If you want help you need to supply more details.

---

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 14, 2017, 4:55pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/3 "2017-02-14T16:55:34Z")

</div>

these are my config at sensu side :  
{  
"logstash": {  
"output": "udp",  
"server": "localhost",  
"port": 5000,  
"list": "logstash",  
"type": "sensu-logstash",  
"custom": {  
"@metadata": {  
"type": "sensu logstash handler",  
"beat": "sensu"  
}  
}  
},  
"handlers": {  
"logstash": {  
"command": "/etc/sensu/handlers/handler-logstash.rb",  
"type": "pipe"  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 14, 2017, 4:58pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/4 "2017-02-14T16:58:42Z")

</div>

config file at logstash.conf  
input {  
tcp {  
port =\> 5000  
type =\> "company-tcp"  
codec =\> "json"  
}  
udp {  
port =\> 5000  
type =\> "company-udp"  
codec =\> "json"  
}  
}

filter {

}

output {  
if ("METRICS" in [tags]) {  
elasticsearch {  
hosts =\> ["elasticsearch"]  
index =\> "metrics-%{+YYYY.MM.dd}"  
}  
} else {  
elasticsearch {  
hosts =\> ["elasticsearch"]  
index =\> "logstash-%{+YYYY.MM.dd}"  
}  
}  
stdout {  
codec =\> rubydebug  
}  
}

---

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 14, 2017, 4:59pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/5 "2017-02-14T16:59:59Z")

</div>

Sensu is executing my checks but on logstash there are no logs from sensu!!!  
thanks in advance

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2017, 5:45pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/6 "2017-02-14T17:45:08Z")

</div>

Have you established that Sensu actually tries to connect to Logstash? Have you looked in the Logstash logs to see if Logstash is having any problems processing the events?

---

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 14, 2017, 6:02pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/7 "2017-02-14T18:02:36Z")

</div>

Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties  
16:36:46.760 [main] INFO logstash.setting.writabledirectory - Creating directory {:setting=\>"path.queue", :path=\>"/usr/share/logstash/data/queue"}  
16:36:46.979 [LogStash::Runner] INFO logstash.agent - No persistent UUID file found. Generating new UUID {:uuid=\>"63bb1755-63ea-43eb-bb36-b02a5a652a18", :path=\>"/var/lib/logstash/uuid"}  
16:36:51.602 [[main]-pipeline-manager] INFO logstash.inputs.tcp - Automatically switching from json to json\_lines codec {:plugin=\>"tcp"}  
16:36:51.632 [[main]-pipeline-manager] INFO logstash.inputs.tcp - Starting tcp input listener {:address=\>"0.0.0.0:5000"}  
16:36:51.816 [[main]\<udp] INFO logstash.inputs.udp - Starting UDP listener {:address=\>"0.0.0.0:5000"}  
16:36:52.276 [[main]\<udp] INFO logstash.inputs.udp - UDP listener started {:address=\>"0.0.0.0:5000", :receive\_buffer\_bytes=\>"106496", :queue\_size=\>"2000"}  
16:36:54.542 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>["[http://elasticsearch:9200](http://elasticsearch:9200)"]}}  
16:36:54.545 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:url=\>#\<URI::HTTP:0x4acb2dae URL:[http://elasticsearch:9200](http://elasticsearch:9200)\>, :healthcheck\_path=\>"/"}  
16:36:55.238 [[main]-pipeline-manager] WARN logstash.outputs.elasticsearch - Restored connection to ES instance {:url=\>#\<URI::HTTP:0x4acb2dae URL:[http://elasticsearch:9200](http://elasticsearch:9200)\>}  
16:36:55.290 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Using mapping template from {:path=\>nil}  
16:36:57.098 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
16:36:57.209 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Installing elasticsearch template to \_template/logstash  
16:36:57.779 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["elasticsearch"]}  
16:36:57.871 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>["[http://elasticsearch:9200](http://elasticsearch:9200)"]}}  
16:36:57.880 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:url=\>#\<URI::HTTP:0x47651915 URL:[http://elasticsearch:9200](http://elasticsearch:9200)\>, :healthcheck\_path=\>"/"}  
16:36:57.903 [[main]-pipeline-manager] WARN logstash.outputs.elasticsearch - Restored connection to ES instance {:url=\>#\<URI::HTTP:0x47651915 URL:[http://elasticsearch:9200](http://elasticsearch:9200)\>}  
16:36:57.950 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Using mapping template from {:path=\>nil}  
16:36:58.077 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
16:36:58.128 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>["elasticsearch"]}  
16:36:58.202 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=\>"main", "pipeline.workers"=\>2, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>250}  
16:36:58.291 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started  
16:36:58.885 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}

---

<div class="post-metadata">

**Author:** ![Lakshmi\_D](https://avatars.discourse-cdn.com/v4/letter/l/bc8723/32.png) [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\
**Post date:** [February 14, 2017, 6:04pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/8 "2017-02-14T18:04:18Z")

</div>

this is my logs for logstash and when i check the lastlog in logstash there are no logs available!!!!!!!!!  
And how can i check the sensu connect to logstash?!!!!

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2017, 7:31pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/9 "2017-02-14T19:31:17Z")

</div>

> this is my logs for logstash and when i check the lastlog in logstash there are no logs available!!!!!!!!!

"lastlog"?

> And how can i check the sensu connect to logstash?!!!!

Wireshark, for example.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2017, 7:31pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920/10 "2017-03-14T19:31:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.